Fortinet - Authentication Bypass

Exploited in the wild. Listed by CISA on 2025-01-14; known to be used by ransomware.

criticalseverity

9.8CVSS score

94.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system.

Impact

Unauthenticated attackers can bypass authentication mechanisms to access sensitive system information and gain unauthorized access to FortiOS and FortiProxy systems.

Fix

Update Fortinet FortiOS and FortiProxy to versions that patch CVE-2024-55591 as specified in Fortinet's security advisory.

How to confirm it

Send: GET {{BaseURL}}/login?redir=/ng
Positive when: contains "<html class=\"main-app\">"
Send: GET /service-worker.js?local_access_token={{randstr}}
Positive when: contains "api/v2/static" and "self.addEventListener" AND contains in content_type "application/javascript" AND status 200

Run it with nuclei: nuclei -id CVE-2024-55591 -u <target>

The full check

id: CVE-2024-55591

info:
  name: Fortinet - Authentication Bypass
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: |
    Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system.
  impact: |
    Unauthenticated attackers can bypass authentication mechanisms to access sensitive system information and gain unauthorized access to FortiOS and FortiProxy systems.
  remediation: |
    Update Fortinet FortiOS and FortiProxy to versions that patch CVE-2024-55591 as specified in Fortinet's security advisory.
  reference:
    - https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591/blob/main/CVE-2024-55591-PoC.py
    - https://nvd.nist.gov/vuln/detail/cve-2024-55591
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-55591
    cwe-id: CWE-288,NVD-CWE-Other
    epss-score: 0.9435
    epss-percentile: 0.99852
    cpe: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fortinet
    product: fortiproxy
  tags: cve,cve2024,fortinet,disclosure,fortios,kev,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/login?redir=/ng"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        words:
          - '<html class="main-app">'
        internal: true

  - raw:
      - |
        GET /service-worker.js?local_access_token={{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "api/v2/static"
          - "self.addEventListener"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/javascript"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from